Is this roadmap realistic for becoming a Web3 Security Researcher? Looking for guidance from experienced auditors

Hi everyone,

I'm from a cybersec background and I'm planning to transition into Web3 security with the long-term goal of becoming a Smart Contract Auditor and Web3 Bug Bounty Hunter.

My current background:

• Networking fundamentals
• Linux
• Python (beginner to intermediate)
• OWASP Top 10
• Basic Web Application Security
• Git/GitHub
• Currently learning cybersecurity and Web2 security

One important thing:- I haven't found my first valid Web2 bug yet, and I have no blockchain or Solidity experience.

After spending a lot of time researching, I've come up with the following roadmap:

1. Learn blockchain fundamentals from Ethereum.org.
2. Complete the Cyfrin Updraft learning paths (Blockchain Basics, Solidity, Foundry, Smart Contract Security, Security Auditing, and Fuzzing).
3. Build projects after every module instead of just watching videos.
4. Solve Ethernaut levels alongside the topics I learn.
5. Complete Damn Vulnerable DeFi.
6. Read real audit reports from OpenZeppelin, Trail of Bits, Code4rena, Sherlock, etc.
7. Participate in CodeHawks First Flights.
8. Move to Sherlock/Cantina contests.
9. Finally start hunting on Immunefi.

My questions are:

1. If you were starting from scratch today, what would you change in this roadmap?
2. Is Cyfrin Updraft sufficient as the main learning platform, or are there any major knowledge gaps I should fill?
3. At what point should I start reading real audit reports?
4. Should I continue practicing Web2 bug bounty alongside Web3, or focus entirely on Web3 from day one?
5. What skill do you think beginners underestimate the most? (Business logic? Reading code? Solidity? DeFi? Something else?)
6. Looking back at your own journey, what mistake cost you the most time?

I'm not looking for shortcuts or unrealistic income expectations. I'm trying to build a strong foundation and become genuinely good at Web3 security over the next 12–18 months.

I'd really appreciate any advice, criticism, or resource recommendations from experienced auditors and researchers.

Thank you!